North

N.W.T. man's blood test results 'inadvertently faxed' to wrong government department

The territory's health authority notified a man that his blood test results were faxed to the Department of Municipal and Community Affairs.

Man from Paulatuk learns a 3rd party sent his private information to wrong recipient

According to a letter from the territory's health authority, on Nov. 9, 2019, a third-party contractor 'inadvertently faxed' Andy Kudlak's name, date of birth, blood results and health care number to the Department of Municipal and Community Affairs. (Shutterstock)

Andy Kudlak checked his mailbox in Paulatuk, N.W.T., hoping that a letter from the territorial government might include some test results he was waiting for. 

What he got instead was a privacy breach notification explaining that on Nov. 9, 2019, a third-party contractor "inadvertently faxed" his name, date of birth, blood results from Alberta company DynaLIFE Medical Labs, and his health care number to the Department of Municipal and Community Affairs.

"I didn't know what to say," said Kudlak. "I was disappointed because it went to another place."

As per the territory's Health Information Act, the Northwest Territories Health and Social Services Authority reported the breach of Kudlak's privacy to the territory's privacy commissioner. 

We continue to receive breach notifications which involve misdirected faxes on a weekly basis.- Elaine Keenan Bengts, N.W.T. privacy commissioner

The letter to Kudlak explains that the authority will advise the privacy commissioner about an investigation, any findings and how it will prevent similar events from happening in the future.

Authority 'confident' issue won't persist

The Northwest Territories Health and Social Services Authority declined an interview for this story, but departmental spokesperson Lisa Giovanetto said in an email that the breach was not caused by the health authority, and the authority is "confident" issues won't persist. 

Alberta Health Services and DynaLIFE were the two third parties involved in the breach. DynaLIFE Medical Labs provides diagnostic lab services in Alberta. Giovanetto clarified Tuesday that the authority has contracts with DynaLIFE labs to provide lab testing for N.W.T. patients.

The company did not respond to requests for comment.

When asked whether third parties like DynaLIFE are bound by the N.W.T. privacy commissioner's recommendation to stop using faxes, Giovanetto said in some cases, fax technology is still needed to deliver care; some communities lack reliable access to internet and fax technology is still necessary.

Giovanetto said Kudlak's results ended up being faxed to the wrong department in the N.W.T. because of recent changes to how Alberta Health Services manages patient information.

On Nov. 3, Alberta Health Services migrated its provincial electronic information system to a new one called Connect Care, Giovanetto said. They moved to a province-wide laboratory information system called EPIC Beaker, which is used to transmit test results, including N.W.T. lab tests.

During that migration, the results for N.W.T. lab tests were arriving inconsistently, said Giovanetto. Alberta Health Services temporarily resorted to faxing results, but some fax numbers were mixed up, she said.

Once the N.W.T. health authority learned of the situation, it stopped all faxing from EPIC Beaker. Clinical and technical teams in both Alberta and the N.W.T. were formed to troubleshoot the Alberta health electronic information system.

Class-action lawsuit

Kudlak says his complaint has been passed on to Cooper Regel, the firm leading a lawsuit over health privacy breaches in the territory.

Lawyer Steven Cooper says breaches like the one affecting Kudlak likely fit under the type of complaints covered by the representative action. A representative action is similar to a class-action lawsuit.

The firm is creating a database of different types of complaints for its lawsuit which is awaiting certification. 

Cooper Regel filed its statement of claim on Sept. 3, 2019, but hasn't heard back from the territorial government. 

Cooper says the lawsuit will seek significant punitive damages because the system is "so malformed and ill-considered in its design that it will continue to do what it is doing now."

As the representative action begins, Cooper says he expects the known breaches are the "proverbial tip of the iceberg."

"I will be pleasantly surprised, as a former N.W.T. resident and lawyer, if there's not more below the surface," he said. 

Misdirected faxes every week

In a report tabled Dec. 11, 2019 in the legislative assembly, N.W.T. privacy commissioner Elaine Keenan Bengts said the government continues to ignore her plea to stop faxing private health information.

"It's a problem throughout Canada in that, for some reason, medical practitioners insist on continuing to use fax machines to communicate personal health information.

Elaine Keenan Bengts, the territory's privacy commissioner, says the most common breaches that occur within the health system is when someone mistakenly faxes personal information to the Yellowknife Primary Care Centre instead of Stanton Territorial Hospital. (Mario De Ciccio/CBC)

"We continue to receive breach notifications which involve misdirected faxes on a weekly basis." 

In some northern communities where Internet bandwidth is an issue, faxing is still commonly used.

Keenan Bengts says she doesn't want to cast health practitioners as being indifferent to privacy.

"The medical services sector is resisting the use of more secure means of communications like encrypted email" and electronic transfer within the medical record system, she said.

She says the most common breaches that occur within the health system is when someone mistakenly faxes personal information to the Yellowknife Primary Care Centre instead of Stanton Territorial Hospital.  

"It's still a breach, right? But it's — you know — they pushed the wrong button."

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.